[java-plugin-shibd] 02/04: Add ECP-compatible treatment of anonymous requests.

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-shibd.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd/commit/c348f60325093fe53ad2515a4a41ca7cd6b28f16

commit c348f60325093fe53ad2515a4a41ca7cd6b28f16
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Thu Aug 6 14:32:32 2026 -0400

    Add ECP-compatible treatment of anonymous requests.
---
 .../impl/SelectRelyingPartyConfiguration.java      | 30 +++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/SelectRelyingPartyConfiguration.java b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/SelectRelyingPartyConfiguration.java
index 21e9a1c..b86eed7 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/SelectRelyingPartyConfiguration.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/SelectRelyingPartyConfiguration.java
@@ -42,6 +42,10 @@ import net.shibboleth.sp.profile.AbstractApplicationAction;
  * using the requesting {@link Application} as the source of configurations rather than the generic resolver used
  * by the IdP.
  * 
+ * <p>A flag exists for the use of the SAML ECP profile such that the absence of a relying party ID is handled
+ * specially as a "verified" request so that the default configuration is resolved instead of the unverified
+ * configuration. SAML ECP is the only such scenario.</p>
+ * 
  * @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
  * @event {@link IdPEventIds#INVALID_RELYING_PARTY_CTX}
  * @event {@link IdPEventIds#INVALID_RELYING_PARTY_CONFIG}
@@ -59,6 +63,9 @@ public final class SelectRelyingPartyConfiguration extends AbstractApplicationAc
      */
     @Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
 
+    /** Flag alllowing anonymous context to be resolved as verified. */
+    private boolean treatAnonymousAsVerified;
+    
     /** The {@link RelyingPartyContext} to manipulate. */
     @NonnullBeforeExec private RelyingPartyContext relyingPartyCtx;
     
@@ -82,6 +89,20 @@ public final class SelectRelyingPartyConfiguration extends AbstractApplicationAc
                 Constraint.isNotNull(strategy, "RelyingPartyContext lookup strategy cannot be null");
     }
     
+    /**
+     * Sets whether the lack of a relying party ID in the context is handled specially as a "verified"
+     * configuration resolution rather than unverified as would typically occur.
+     * 
+     * <p>Defaults to false.</p>
+     * 
+     * @param flag flag to set
+     */
+    public void setTreatAnonymousAsVerified(final boolean flag) {
+        checkSetterPreconditions();
+        
+        treatAnonymousAsVerified = flag;
+    }
+    
     /** Null safe getter.
      * @return Returns the relyingPartyCtx.
      */
@@ -114,9 +135,16 @@ public final class SelectRelyingPartyConfiguration extends AbstractApplicationAc
 
         try {
             final CriteriaSet criteria = new CriteriaSet();
-            if (getRelyingPartyCtx().isVerified()) {
+            
+            // Verified status notmally depends on the context's own computation but may be
+            // overridden by a flag in the absence of a relying party.
+            
+            if (relyingPartyCtx.getRelyingPartyId() == null && treatAnonymousAsVerified) {
+                criteria.add(new VerifiedProfileCriterion(true));
+            } else if (getRelyingPartyCtx().isVerified()) {
                 criteria.add(new VerifiedProfileCriterion(true));
             }
+            
             criteria.add(new ProfileRequestContextCriterion(profileRequestContext));
 
             final RelyingPartyConfiguration config = ensureApplication().resolveSingle(criteria);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.